Cryptographically verifying a firmware image with boot speed in an information handling system
An information handling system includes a first memory that stores a firmware image associated with the baseboard management controller. The baseboard management controller begins execution of a kernel, which in turn performs a boot operation of the information handling system. The baseboard management controller begins a file system initialization program. During the boot operation, the baseboard management controller performs a full read and cryptographic verification of the firmware image via a DM-Verity daemon of the file system initialization program. In response to the full read of the firmware image being completed, the baseboard management controller provides a flush command to the kernel via the DM-Verity daemon. The baseboard management controller flushes a cache buffer associated with the baseboard management controller via the kernel.
1. An information handling system comprising:
a first memory to store a firmware image; and
a baseboard management controller to:
begin execution of a kernel, the kernel to perform a boot operation of the information handling system;
begin a file system initialization program;
during the boot operation, the baseboard management controller to:
perform, via a DM-Verity daemon, a full read and cryptographic verification of the firmware image;
in response to the full read of the firmware image being completed, provide, via the DM-Verity daemon, a flush command to the kernel; and
flush, via the kernel, a cache buffer associated with the baseboard management controller.
2. The information handling system of claim 1 , prior to the beginning of the kernel and file system initialization program, the baseboard management controller further to:
perform a cryptographic verification of the kernel and the file system initialization program.
3. The information handling system of claim 1 , wherein the baseboard management controller further to:
utilize, via the kernel, the data in cache buffer after the data is stored by the DM-Verity daemon.
4. The information handling system of claim 1 , the baseboard management controller further to:
in response to the boot operation being completed, perform, via the DM-Verity, a slow patrol read of the firmware image; and
during the slow patrol read, store data associated with the slow patrol read in the cache buffer; and
in response to the slow patrol read being completed, flush the cache buffer.
5. The information handling system of claim 4 , wherein the slow patrol read of firmware image is performed at periodic intervals.
6. The information handling system of claim 1 , wherein data is stored in the cache buffer during the full read of the firmware image.
7. The information handling system of claim 1 , wherein the full read of the firmware image is performed as a background operation during the boot operation.
8. The information handling system of claim 1 , wherein a priority level of the full read is set to a low priority level to enable processing resources of the information handling system to be allocated to the boot operation.
9. A method comprising:
storing a firmware image in a first memory, wherein the firmware image is associated with a baseboard management controller of an information handling system;
beginning execution of a kernel, the kernel to perform a boot operation of the information handling system;
beginning a file system initialization program;
during the boot operation:
performing, by a DM-Verity daemon, a full read and cryptographic verification of the firmware image; and
in response to the full read of the firmware image being completed, providing, via the DM-Verity daemon, a flush command to the kernel; and
flushing, via the kernel, a cache buffer associated with the baseboard management controller.
10. The method of claim 9 , wherein prior to the beginning of the kernel and file system initialization program, the method further comprises performing a cryptographic verification of the kernel and the file system initialization program.
11. The method of claim 9 , further comprising utilizing, by the kernel, the data in cache buffer after the data is stored by the DM-Verity daemon.
12. The method of claim 9 , further comprising:
in response to the boot operation being completed, performing, by the DM-Verity, a slow patrol read of the firmware image; and
during the slow patrol read, storing data associated with the slow patrol read in the cache buffer; and
in response to the slow patrol read being completed, flushing the cache buffer.
13. The method of claim 12 , wherein the slow patrol read of firmware image is performed at periodic intervals.
14. The method of claim 9 , wherein data is stored in the cache buffer during the full read of the firmware image.
15. The method of claim 9 , wherein the full read of the firmware image is performed as a background operation during the boot operation.
16. The method of claim 9 , further comprising setting a priority level of the full read to a low priority level to enable processing resources of the information handling system to be allocated to the boot operation.
17. A method comprising:
storing a firmware image in a first memory, wherein the firmware image is associated with a baseboard management controller of an information handling system;
performing a cryptographic verification of a kernel and a file system initialization program;
if the kernel is cryptographically verified, then beginning execution of the kernel, the kernel to perform a boot operation of the information handling system;
if the kernel is cryptographically verified, then beginning the file system initialization program;
during the boot operation:
performing, by a DM-Verity daemon, a full read and cryptographic verification of the firmware image;
storing, by the DM-Verity daemon, data associated with the cryptographic verification of the firmware image in a cache buffer;
utilizing, by the kernel, the data in cache buffer after being stored by the DM-Verity daemon; and
if the full read of the firmware image is complete, then providing, via the DM-Verity daemon, a flush command to the kernel; and
flushing, via the kernel, the cache buffer.
18. The method of claim 17 , further comprising:
in response to the boot operation being completed, performing, by the DM-Verity, a slow patrol read of the firmware image; and
during the slow patrol read, storing data associated with the slow patrol read in the cache buffer; and
in response to the slow patrol read being completed, flushing the cache buffer.
19. The method of claim 17 , wherein the full read of the firmware image is performed as a background operation during the boot operation.
20. The method of claim 17 , further comprising setting a priority level of the full read to a low priority level to enable processing resources of the information handling system to be allocated to the boot operation.